1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2020 - Google Inc 4 * Author: Andrew Scull <ascull@google.com> 5 */ 6 7 #include <hyp/adjust_pc.h> 8 9 #include <asm/pgtable-types.h> 10 #include <asm/kvm_asm.h> 11 #include <asm/kvm_emulate.h> 12 #include <asm/kvm_host.h> 13 #include <asm/kvm_hyp.h> 14 #include <asm/kvm_mmu.h> 15 16 #include <nvhe/ffa.h> 17 #include <nvhe/mem_protect.h> 18 #include <nvhe/mm.h> 19 #include <nvhe/pkvm.h> 20 #include <nvhe/trap_handler.h> 21 22 DEFINE_PER_CPU(struct kvm_nvhe_init_params, kvm_init_params); 23 24 void __kvm_hyp_host_forward_smc(struct kvm_cpu_context *host_ctxt); 25 26 static void __hyp_sve_save_guest(struct kvm_vcpu *vcpu) 27 { 28 __vcpu_sys_reg(vcpu, ZCR_EL1) = read_sysreg_el1(SYS_ZCR); 29 /* 30 * On saving/restoring guest sve state, always use the maximum VL for 31 * the guest. The layout of the data when saving the sve state depends 32 * on the VL, so use a consistent (i.e., the maximum) guest VL. 33 */ 34 sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2); 35 __sve_save_state(vcpu_sve_pffr(vcpu), &vcpu->arch.ctxt.fp_regs.fpsr, true); 36 write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2); 37 } 38 39 static void __hyp_sve_restore_host(void) 40 { 41 struct cpu_sve_state *sve_state = *host_data_ptr(sve_state); 42 43 /* 44 * On saving/restoring host sve state, always use the maximum VL for 45 * the host. The layout of the data when saving the sve state depends 46 * on the VL, so use a consistent (i.e., the maximum) host VL. 47 * 48 * Note that this constrains the PE to the maximum shared VL 49 * that was discovered, if we wish to use larger VLs this will 50 * need to be revisited. 51 */ 52 write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2); 53 __sve_restore_state(sve_state->sve_regs + sve_ffr_offset(kvm_host_sve_max_vl), 54 &sve_state->fpsr, 55 true); 56 write_sysreg_el1(sve_state->zcr_el1, SYS_ZCR); 57 } 58 59 static void fpsimd_sve_flush(void) 60 { 61 *host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED; 62 } 63 64 static void fpsimd_sve_sync(struct kvm_vcpu *vcpu) 65 { 66 bool has_fpmr; 67 68 if (!guest_owns_fp_regs()) 69 return; 70 71 cpacr_clear_set(0, CPACR_ELx_FPEN | CPACR_ELx_ZEN); 72 isb(); 73 74 if (vcpu_has_sve(vcpu)) 75 __hyp_sve_save_guest(vcpu); 76 else 77 __fpsimd_save_state(&vcpu->arch.ctxt.fp_regs); 78 79 has_fpmr = kvm_has_fpmr(kern_hyp_va(vcpu->kvm)); 80 if (has_fpmr) 81 __vcpu_sys_reg(vcpu, FPMR) = read_sysreg_s(SYS_FPMR); 82 83 if (system_supports_sve()) 84 __hyp_sve_restore_host(); 85 else 86 __fpsimd_restore_state(*host_data_ptr(fpsimd_state)); 87 88 if (has_fpmr) 89 write_sysreg_s(*host_data_ptr(fpmr), SYS_FPMR); 90 91 *host_data_ptr(fp_owner) = FP_STATE_HOST_OWNED; 92 } 93 94 static void flush_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu) 95 { 96 struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu; 97 98 fpsimd_sve_flush(); 99 100 hyp_vcpu->vcpu.arch.ctxt = host_vcpu->arch.ctxt; 101 102 hyp_vcpu->vcpu.arch.sve_state = kern_hyp_va(host_vcpu->arch.sve_state); 103 /* Limit guest vector length to the maximum supported by the host. */ 104 hyp_vcpu->vcpu.arch.sve_max_vl = min(host_vcpu->arch.sve_max_vl, kvm_host_sve_max_vl); 105 106 hyp_vcpu->vcpu.arch.hw_mmu = host_vcpu->arch.hw_mmu; 107 108 hyp_vcpu->vcpu.arch.mdcr_el2 = host_vcpu->arch.mdcr_el2; 109 hyp_vcpu->vcpu.arch.hcr_el2 &= ~(HCR_TWI | HCR_TWE); 110 hyp_vcpu->vcpu.arch.hcr_el2 |= READ_ONCE(host_vcpu->arch.hcr_el2) & 111 (HCR_TWI | HCR_TWE); 112 113 hyp_vcpu->vcpu.arch.iflags = host_vcpu->arch.iflags; 114 115 hyp_vcpu->vcpu.arch.debug_ptr = kern_hyp_va(host_vcpu->arch.debug_ptr); 116 117 hyp_vcpu->vcpu.arch.vsesr_el2 = host_vcpu->arch.vsesr_el2; 118 119 hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3 = host_vcpu->arch.vgic_cpu.vgic_v3; 120 } 121 122 static void sync_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu) 123 { 124 struct kvm_vcpu *host_vcpu = hyp_vcpu->host_vcpu; 125 struct vgic_v3_cpu_if *hyp_cpu_if = &hyp_vcpu->vcpu.arch.vgic_cpu.vgic_v3; 126 struct vgic_v3_cpu_if *host_cpu_if = &host_vcpu->arch.vgic_cpu.vgic_v3; 127 unsigned int i; 128 129 fpsimd_sve_sync(&hyp_vcpu->vcpu); 130 131 host_vcpu->arch.ctxt = hyp_vcpu->vcpu.arch.ctxt; 132 133 host_vcpu->arch.hcr_el2 = hyp_vcpu->vcpu.arch.hcr_el2; 134 135 host_vcpu->arch.fault = hyp_vcpu->vcpu.arch.fault; 136 137 host_vcpu->arch.iflags = hyp_vcpu->vcpu.arch.iflags; 138 139 host_cpu_if->vgic_hcr = hyp_cpu_if->vgic_hcr; 140 for (i = 0; i < hyp_cpu_if->used_lrs; ++i) 141 host_cpu_if->vgic_lr[i] = hyp_cpu_if->vgic_lr[i]; 142 } 143 144 static void handle___kvm_vcpu_run(struct kvm_cpu_context *host_ctxt) 145 { 146 DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 1); 147 int ret; 148 149 host_vcpu = kern_hyp_va(host_vcpu); 150 151 if (unlikely(is_protected_kvm_enabled())) { 152 struct pkvm_hyp_vcpu *hyp_vcpu; 153 struct kvm *host_kvm; 154 155 /* 156 * KVM (and pKVM) doesn't support SME guests for now, and 157 * ensures that SME features aren't enabled in pstate when 158 * loading a vcpu. Therefore, if SME features enabled the host 159 * is misbehaving. 160 */ 161 if (unlikely(system_supports_sme() && read_sysreg_s(SYS_SVCR))) { 162 ret = -EINVAL; 163 goto out; 164 } 165 166 host_kvm = kern_hyp_va(host_vcpu->kvm); 167 hyp_vcpu = pkvm_load_hyp_vcpu(host_kvm->arch.pkvm.handle, 168 host_vcpu->vcpu_idx); 169 if (!hyp_vcpu) { 170 ret = -EINVAL; 171 goto out; 172 } 173 174 flush_hyp_vcpu(hyp_vcpu); 175 176 ret = __kvm_vcpu_run(&hyp_vcpu->vcpu); 177 178 sync_hyp_vcpu(hyp_vcpu); 179 pkvm_put_hyp_vcpu(hyp_vcpu); 180 } else { 181 /* The host is fully trusted, run its vCPU directly. */ 182 ret = __kvm_vcpu_run(host_vcpu); 183 } 184 185 out: 186 cpu_reg(host_ctxt, 1) = ret; 187 } 188 189 static void handle___kvm_adjust_pc(struct kvm_cpu_context *host_ctxt) 190 { 191 DECLARE_REG(struct kvm_vcpu *, vcpu, host_ctxt, 1); 192 193 __kvm_adjust_pc(kern_hyp_va(vcpu)); 194 } 195 196 static void handle___kvm_flush_vm_context(struct kvm_cpu_context *host_ctxt) 197 { 198 __kvm_flush_vm_context(); 199 } 200 201 static void handle___kvm_tlb_flush_vmid_ipa(struct kvm_cpu_context *host_ctxt) 202 { 203 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 204 DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2); 205 DECLARE_REG(int, level, host_ctxt, 3); 206 207 __kvm_tlb_flush_vmid_ipa(kern_hyp_va(mmu), ipa, level); 208 } 209 210 static void handle___kvm_tlb_flush_vmid_ipa_nsh(struct kvm_cpu_context *host_ctxt) 211 { 212 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 213 DECLARE_REG(phys_addr_t, ipa, host_ctxt, 2); 214 DECLARE_REG(int, level, host_ctxt, 3); 215 216 __kvm_tlb_flush_vmid_ipa_nsh(kern_hyp_va(mmu), ipa, level); 217 } 218 219 static void 220 handle___kvm_tlb_flush_vmid_range(struct kvm_cpu_context *host_ctxt) 221 { 222 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 223 DECLARE_REG(phys_addr_t, start, host_ctxt, 2); 224 DECLARE_REG(unsigned long, pages, host_ctxt, 3); 225 226 __kvm_tlb_flush_vmid_range(kern_hyp_va(mmu), start, pages); 227 } 228 229 static void handle___kvm_tlb_flush_vmid(struct kvm_cpu_context *host_ctxt) 230 { 231 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 232 233 __kvm_tlb_flush_vmid(kern_hyp_va(mmu)); 234 } 235 236 static void handle___kvm_flush_cpu_context(struct kvm_cpu_context *host_ctxt) 237 { 238 DECLARE_REG(struct kvm_s2_mmu *, mmu, host_ctxt, 1); 239 240 __kvm_flush_cpu_context(kern_hyp_va(mmu)); 241 } 242 243 static void handle___kvm_timer_set_cntvoff(struct kvm_cpu_context *host_ctxt) 244 { 245 __kvm_timer_set_cntvoff(cpu_reg(host_ctxt, 1)); 246 } 247 248 static void handle___kvm_enable_ssbs(struct kvm_cpu_context *host_ctxt) 249 { 250 u64 tmp; 251 252 tmp = read_sysreg_el2(SYS_SCTLR); 253 tmp |= SCTLR_ELx_DSSBS; 254 write_sysreg_el2(tmp, SYS_SCTLR); 255 } 256 257 static void handle___vgic_v3_get_gic_config(struct kvm_cpu_context *host_ctxt) 258 { 259 cpu_reg(host_ctxt, 1) = __vgic_v3_get_gic_config(); 260 } 261 262 static void handle___vgic_v3_init_lrs(struct kvm_cpu_context *host_ctxt) 263 { 264 __vgic_v3_init_lrs(); 265 } 266 267 static void handle___kvm_get_mdcr_el2(struct kvm_cpu_context *host_ctxt) 268 { 269 cpu_reg(host_ctxt, 1) = __kvm_get_mdcr_el2(); 270 } 271 272 static void handle___vgic_v3_save_vmcr_aprs(struct kvm_cpu_context *host_ctxt) 273 { 274 DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1); 275 276 __vgic_v3_save_vmcr_aprs(kern_hyp_va(cpu_if)); 277 } 278 279 static void handle___vgic_v3_restore_vmcr_aprs(struct kvm_cpu_context *host_ctxt) 280 { 281 DECLARE_REG(struct vgic_v3_cpu_if *, cpu_if, host_ctxt, 1); 282 283 __vgic_v3_restore_vmcr_aprs(kern_hyp_va(cpu_if)); 284 } 285 286 static void handle___pkvm_init(struct kvm_cpu_context *host_ctxt) 287 { 288 DECLARE_REG(phys_addr_t, phys, host_ctxt, 1); 289 DECLARE_REG(unsigned long, size, host_ctxt, 2); 290 DECLARE_REG(unsigned long, nr_cpus, host_ctxt, 3); 291 DECLARE_REG(unsigned long *, per_cpu_base, host_ctxt, 4); 292 DECLARE_REG(u32, hyp_va_bits, host_ctxt, 5); 293 294 /* 295 * __pkvm_init() will return only if an error occurred, otherwise it 296 * will tail-call in __pkvm_init_finalise() which will have to deal 297 * with the host context directly. 298 */ 299 cpu_reg(host_ctxt, 1) = __pkvm_init(phys, size, nr_cpus, per_cpu_base, 300 hyp_va_bits); 301 } 302 303 static void handle___pkvm_cpu_set_vector(struct kvm_cpu_context *host_ctxt) 304 { 305 DECLARE_REG(enum arm64_hyp_spectre_vector, slot, host_ctxt, 1); 306 307 cpu_reg(host_ctxt, 1) = pkvm_cpu_set_vector(slot); 308 } 309 310 static void handle___pkvm_host_share_hyp(struct kvm_cpu_context *host_ctxt) 311 { 312 DECLARE_REG(u64, pfn, host_ctxt, 1); 313 314 cpu_reg(host_ctxt, 1) = __pkvm_host_share_hyp(pfn); 315 } 316 317 static void handle___pkvm_host_unshare_hyp(struct kvm_cpu_context *host_ctxt) 318 { 319 DECLARE_REG(u64, pfn, host_ctxt, 1); 320 321 cpu_reg(host_ctxt, 1) = __pkvm_host_unshare_hyp(pfn); 322 } 323 324 static void handle___pkvm_create_private_mapping(struct kvm_cpu_context *host_ctxt) 325 { 326 DECLARE_REG(phys_addr_t, phys, host_ctxt, 1); 327 DECLARE_REG(size_t, size, host_ctxt, 2); 328 DECLARE_REG(enum kvm_pgtable_prot, prot, host_ctxt, 3); 329 330 /* 331 * __pkvm_create_private_mapping() populates a pointer with the 332 * hypervisor start address of the allocation. 333 * 334 * However, handle___pkvm_create_private_mapping() hypercall crosses the 335 * EL1/EL2 boundary so the pointer would not be valid in this context. 336 * 337 * Instead pass the allocation address as the return value (or return 338 * ERR_PTR() on failure). 339 */ 340 unsigned long haddr; 341 int err = __pkvm_create_private_mapping(phys, size, prot, &haddr); 342 343 if (err) 344 haddr = (unsigned long)ERR_PTR(err); 345 346 cpu_reg(host_ctxt, 1) = haddr; 347 } 348 349 static void handle___pkvm_prot_finalize(struct kvm_cpu_context *host_ctxt) 350 { 351 cpu_reg(host_ctxt, 1) = __pkvm_prot_finalize(); 352 } 353 354 static void handle___pkvm_init_vm(struct kvm_cpu_context *host_ctxt) 355 { 356 DECLARE_REG(struct kvm *, host_kvm, host_ctxt, 1); 357 DECLARE_REG(unsigned long, vm_hva, host_ctxt, 2); 358 DECLARE_REG(unsigned long, pgd_hva, host_ctxt, 3); 359 360 host_kvm = kern_hyp_va(host_kvm); 361 cpu_reg(host_ctxt, 1) = __pkvm_init_vm(host_kvm, vm_hva, pgd_hva); 362 } 363 364 static void handle___pkvm_init_vcpu(struct kvm_cpu_context *host_ctxt) 365 { 366 DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); 367 DECLARE_REG(struct kvm_vcpu *, host_vcpu, host_ctxt, 2); 368 DECLARE_REG(unsigned long, vcpu_hva, host_ctxt, 3); 369 370 host_vcpu = kern_hyp_va(host_vcpu); 371 cpu_reg(host_ctxt, 1) = __pkvm_init_vcpu(handle, host_vcpu, vcpu_hva); 372 } 373 374 static void handle___pkvm_teardown_vm(struct kvm_cpu_context *host_ctxt) 375 { 376 DECLARE_REG(pkvm_handle_t, handle, host_ctxt, 1); 377 378 cpu_reg(host_ctxt, 1) = __pkvm_teardown_vm(handle); 379 } 380 381 typedef void (*hcall_t)(struct kvm_cpu_context *); 382 383 #define HANDLE_FUNC(x) [__KVM_HOST_SMCCC_FUNC_##x] = (hcall_t)handle_##x 384 385 static const hcall_t host_hcall[] = { 386 /* ___kvm_hyp_init */ 387 HANDLE_FUNC(__kvm_get_mdcr_el2), 388 HANDLE_FUNC(__pkvm_init), 389 HANDLE_FUNC(__pkvm_create_private_mapping), 390 HANDLE_FUNC(__pkvm_cpu_set_vector), 391 HANDLE_FUNC(__kvm_enable_ssbs), 392 HANDLE_FUNC(__vgic_v3_init_lrs), 393 HANDLE_FUNC(__vgic_v3_get_gic_config), 394 HANDLE_FUNC(__pkvm_prot_finalize), 395 396 HANDLE_FUNC(__pkvm_host_share_hyp), 397 HANDLE_FUNC(__pkvm_host_unshare_hyp), 398 HANDLE_FUNC(__kvm_adjust_pc), 399 HANDLE_FUNC(__kvm_vcpu_run), 400 HANDLE_FUNC(__kvm_flush_vm_context), 401 HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa), 402 HANDLE_FUNC(__kvm_tlb_flush_vmid_ipa_nsh), 403 HANDLE_FUNC(__kvm_tlb_flush_vmid), 404 HANDLE_FUNC(__kvm_tlb_flush_vmid_range), 405 HANDLE_FUNC(__kvm_flush_cpu_context), 406 HANDLE_FUNC(__kvm_timer_set_cntvoff), 407 HANDLE_FUNC(__vgic_v3_save_vmcr_aprs), 408 HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs), 409 HANDLE_FUNC(__pkvm_init_vm), 410 HANDLE_FUNC(__pkvm_init_vcpu), 411 HANDLE_FUNC(__pkvm_teardown_vm), 412 }; 413 414 static void handle_host_hcall(struct kvm_cpu_context *host_ctxt) 415 { 416 DECLARE_REG(unsigned long, id, host_ctxt, 0); 417 unsigned long hcall_min = 0; 418 hcall_t hfn; 419 420 /* 421 * If pKVM has been initialised then reject any calls to the 422 * early "privileged" hypercalls. Note that we cannot reject 423 * calls to __pkvm_prot_finalize for two reasons: (1) The static 424 * key used to determine initialisation must be toggled prior to 425 * finalisation and (2) finalisation is performed on a per-CPU 426 * basis. This is all fine, however, since __pkvm_prot_finalize 427 * returns -EPERM after the first call for a given CPU. 428 */ 429 if (static_branch_unlikely(&kvm_protected_mode_initialized)) 430 hcall_min = __KVM_HOST_SMCCC_FUNC___pkvm_prot_finalize; 431 432 id &= ~ARM_SMCCC_CALL_HINTS; 433 id -= KVM_HOST_SMCCC_ID(0); 434 435 if (unlikely(id < hcall_min || id >= ARRAY_SIZE(host_hcall))) 436 goto inval; 437 438 hfn = host_hcall[id]; 439 if (unlikely(!hfn)) 440 goto inval; 441 442 cpu_reg(host_ctxt, 0) = SMCCC_RET_SUCCESS; 443 hfn(host_ctxt); 444 445 return; 446 inval: 447 cpu_reg(host_ctxt, 0) = SMCCC_RET_NOT_SUPPORTED; 448 } 449 450 static void default_host_smc_handler(struct kvm_cpu_context *host_ctxt) 451 { 452 __kvm_hyp_host_forward_smc(host_ctxt); 453 } 454 455 static void handle_host_smc(struct kvm_cpu_context *host_ctxt) 456 { 457 DECLARE_REG(u64, func_id, host_ctxt, 0); 458 bool handled; 459 460 func_id &= ~ARM_SMCCC_CALL_HINTS; 461 462 handled = kvm_host_psci_handler(host_ctxt, func_id); 463 if (!handled) 464 handled = kvm_host_ffa_handler(host_ctxt, func_id); 465 if (!handled) 466 default_host_smc_handler(host_ctxt); 467 468 /* SMC was trapped, move ELR past the current PC. */ 469 kvm_skip_host_instr(); 470 } 471 472 void handle_trap(struct kvm_cpu_context *host_ctxt) 473 { 474 u64 esr = read_sysreg_el2(SYS_ESR); 475 476 switch (ESR_ELx_EC(esr)) { 477 case ESR_ELx_EC_HVC64: 478 handle_host_hcall(host_ctxt); 479 break; 480 case ESR_ELx_EC_SMC64: 481 handle_host_smc(host_ctxt); 482 break; 483 case ESR_ELx_EC_SVE: 484 cpacr_clear_set(0, CPACR_ELx_ZEN); 485 isb(); 486 sve_cond_update_zcr_vq(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, 487 SYS_ZCR_EL2); 488 break; 489 case ESR_ELx_EC_IABT_LOW: 490 case ESR_ELx_EC_DABT_LOW: 491 handle_host_mem_abort(host_ctxt); 492 break; 493 default: 494 BUG(); 495 } 496 } 497